I'm developing a standalone application using java, I have a Login screen, wherein user enters his username and password. For each instance of the application, user have to enter his credentials. From a usability standpoint, I thought of keeping a remember me check Button. My question is, as I am not using any database, how do I persist the user details. I have some rough thoughts, storing them in a property file and retrieving. I think there may be better approaches than the one I had. Any Ideas and suggestions?
It's not uncommon to store user credentials in a file. It is common to use a text file where each line is a delimited set of user credentials, like the following.
The format is not important, but it is good practice to avoid storing clear-text passwords. The credentials above use a cryptographic hash function that generates an "irreversible" byte array, which is then Base64 encoded to reduce it to ASCII characters. This is known as a "password digest". When a person enters their password, it is first converted to the digest form which is then compared with the stored digest.
SHA1 is the recommended hash function, and I use Base64 because it it produces smaller digests that hex encoding. Here's some sample code:
It is also important where you store this file. Simply hashing your password is not a sufficient means of protecting your data. The credentials file should be inaccessible to the end user. Although SHA-1 is irreversible algorithmically, it is susceptible to brute-force and rainbow-table attacks, and therefore must remain securely stored. Especially for weak passwords.
Presumably, you are using a password because you are protecting some data or resource that the user would otherwise not have access to. There is no sense password protecting an application if there is no data, or if the data is otherwise accessible to the user from the file system. So I'm not sure what you are protecting -- you say you have no data-base.
If you are protecting data on the local file-system, and it is only accessible to one user, I would suggest encrypting the data using an AES cipher and using the user's password digest as the encryption key. The draw-back to this is that the user can never change their password.
If you are protecting data on a shared file-system, or a time-share PC, data should probably be stored in an access controlled directory and accessed using some asymmetric key system like RSA.
If you are protecting access to a remote service, the passwords should be stored on the remote system.
So we really need to know what you are protecting.